[clang] [clang][analyzer] Fix liveness and analysis of [[assume]] attributes (PR #198618)

Balázs Benics via cfe-commits cfe-commits at lists.llvm.org
Thu May 21 03:37:11 PDT 2026


================
@@ -1224,16 +1224,33 @@ void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
 
 void ExprEngine::VisitAttributedStmt(const AttributedStmt *A,
                                      ExplodedNode *Pred, ExplodedNodeSet &Dst) {
+  const LocationContext *LCtx = Pred->getLocationContext();
   ExplodedNodeSet CheckerPreStmt;
   getCheckerManager().runCheckersForPreStmt(CheckerPreStmt, Pred, A, *this);
 
   ExplodedNodeSet EvalSet;
-  NodeBuilder Bldr(CheckerPreStmt, EvalSet, *currBldrCtx);
 
-  for (const auto *Attr : getSpecificAttrs<CXXAssumeAttr>(A->getAttrs())) {
-    for (ExplodedNode *N : CheckerPreStmt) {
-      Visit(Attr->getAssumption()->IgnoreParens(), N, EvalSet);
+  for (ExplodedNode *N : CheckerPreStmt) {
+    ProgramStateRef State = N->getState();
+    for (const auto *Attr : getSpecificAttrs<CXXAssumeAttr>(A->getAttrs())) {
+      SVal AssumedVal = State->getSVal(Attr->getAssumption(), LCtx);
+      if (auto ValidAssumedVal = AssumedVal.getAs<DefinedOrUnknownSVal>()) {
+        State = State->assume(*ValidAssumedVal, true);
+      } else {
+        // The assumption expression has evaluated to UndefinedVal.
----------------
steakhal wrote:

If I understand this correctly, in the past if the assume-expr was Undef, we just continued.
(This is proven by the fact that we report [here](https://godbolt.org/z/WYrx5fd3r).)
After this patch, we would no longer get this actually TP report, right?

We could have 2 options here:
 - Have a checker that would report that the assume expr is Undef in a `runCheckersForPreStmt` handler, or
 - Skip adding the `assume true` constraint to the apparently `undef` assume expr.
 
The latter would make sure that it behaves as if we didn't take the assumption into account - as if it was completely ignored. Implementations are allowed to ignore them.

IMO approach (1) is better, and isn't that when iterating the `CheckerPreStmt` it would skip sink nodes? Thus would naturally imply that the assumption expr can't be Undef here? (assuming that the imaginary core checker reporting undef assumptions is enabled)?

https://github.com/llvm/llvm-project/pull/198618


More information about the cfe-commits mailing list